Send the document.
Keep the control.
TriLockSafe delivers your sensitive files through a locked, zero-install web viewer — where print limits are enforced on the server, every page is watermarked to the reader, and access is revoked the instant you decide. No downloadable PDF ever leaves the vault.
TriLockSafe · do not distribute
A PDF you email is a PDF you've already lost.
Password-protected PDFs are cracked, stripped, or simply forwarded with the password.
Once it's downloaded, you can't limit prints, expire it, or take it back.
Nothing on the leaked copy tells you who leaked it.
Vendor DRM fixes some of this — then makes every reader install a desktop app and charges you per seat.
The file becomes page images behind a login. Printing becomes a server decision.
Nothing your reader can reach is a downloadable document. The rights travel with the access, not the file.
Publish
The offline writer rasterizes your PDF into per-page images and pushes them to private storage. The original never goes to the edge.
Lock & grant
You issue a personal access link with a print allowance — 3, 5, whatever you set. Each recipient gets their own watermark and their own counter.
Enforce
Every open is logged, every page served no-store, every print counted. At the limit, the server simply refuses — and you can revoke anyone in one click.
-- Grants a print ONLY if one remains. Runs as a single D1 statement, -- so two simultaneous prints at the limit can never both win. UPDATE recipients SET prints_used = prints_used + 1 WHERE id = ? AND prints_used < max_prints; -- 0 rows changed → server returns print_limit_reached
Everything a vendor DRM does — on infrastructure you own.
Server-enforced print limits
The (N+1)th print is refused by the backend, not by a checkbox in the reader.
No-download locked viewer
Documents render as page images behind an authenticated session. There's no PDF to save.
Per-recipient watermark
Name, email and timestamp burned across every screen and every printed page — a forensic trail on any leak.
Instant revocation
Kill any recipient's access from the console immediately — no re-send, no waiting on the file.
Access expiry
Links can expire on a fixed date or after a set window. Old grants stop working on their own.
Full audit trail
Every open and every print recorded with IP, device and timestamp — exportable evidence, per recipient.
Zero install for readers
Opens in any browser. Your clients never download a desktop “secure viewer” to read your document.
Self-hosted, own your data
Runs entirely on your Cloudflare account. No third party ever holds your documents or your clients.
Multi-tenant
One deployment, isolated tenants — reuse it for every client and every brand you serve.
OTP-protected admin
Console access is one-time-code gated. Codes and print tokens are short-lived and single-use.
Screenshot & copy deterrence
Selection, right-click, save and print shortcuts are blocked; the watermark identifies anyone who photographs the screen.
Global edge delivery
Served from Cloudflare's network — fast for a reader in any region, with no origin to scale.
Locklizard-grade control, without the desktop app or the per-seat bill.
| Emailing a PDF | Vendor DRM (e.g. Locklizard) | TriLockSafe | |
|---|---|---|---|
| Reader installs an app | None | Desktop “Safeguard Viewer” required | None — any browser |
| Where it runs | Your outbox | Vendor cloud / vendor licensing server | Your own Cloudflare account |
| Cost model | — | Per-user / per-seat licensing | Your edge, flat infra cost |
| Enforced print limit | ✕ | ✓ | ✓ atomic, server-side |
| Per-reader forensic watermark | ✕ | ✓ | ✓ screen & print |
| Instant revoke after sending | ✕ | ✓ | ✓ one click |
| Open & print audit trail | ✕ | Partial | ✓ per recipient, exportable |
| Own your documents & client list | ✓ | ✕ held by vendor | ✓ entirely yours |
Built security-first, and honest about the one thing no DRM can stop.
Signed, expiring sessions
Access and print tokens are HMAC-signed with your secret and delivered as HttpOnly, Secure, SameSite=Strict cookies.
Single-use print tokens
Each granted print issues a one-time token that lives ~150 seconds and is burned on use — it can't be replayed.
Nothing cached, nothing stored
Pages are served no-store, private. The document exists only as authenticated image streams — never as a saveable file.
Immutable audit log
Every open and print is appended to a tamper-evident trail with device and network fingerprints, per recipient.
Put the next document behind the lock.
Register a document, grant a reader three prints, and watch the counter hold. The whole workflow runs from your admin console.